Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package helm for openSUSE:Factory checked in at 2026-09-19 22:20:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/helm (Old) and /work/SRC/openSUSE:Factory/.helm.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "helm" Sat Sep 19 22:20:03 2026 rev:115 rq:1378874 version:4.3.0 Changes: -------- --- /work/SRC/openSUSE:Factory/helm/helm.changes 2026-09-08 16:53:45.840076007 +0200 +++ /work/SRC/openSUSE:Factory/.helm.new.383539/helm.changes 2026-09-19 22:20:42.565520548 +0200 @@ -1,0 +2,28 @@ +Fri Sep 18 17:43:50 UTC 2026 - Dirk Müller <[email protected]> + +- update to 4.3.0: + * feat: Add duration functions + * feat(engine): add debug logging when lookup returns empty + * feat: add ownership verification before deleting resources + * feat: honor SOURCE_DATE_EPOCH for chart archives + * feat(rollback): add --description flag to provide rollback + reason + * fix (internal/plugin): remove zero-width spaces from plugin + name comment + * fix(loader): do not drop values files ending at a 4096-byte + boundary + * fix(chart): normalize StampModTimes timestamp to UTC/truncate + + Chart.lock reproducibility test + * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings + * fix(template): regression - route registry messages to stderr + in template and show + * refactor: lower resync period from one hour to 3 minutes + * perf: enable concurrent status computation to prevent + multi-minute delays +- drop CVE-2026-63308.patch: merged upstream +- update vendor.tar. to fix: + * bsc#1281426, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: helm: + golang.org/x/crypto/ssh: authentication bypass and deadlocks + in the crypto/ssh library + +------------------------------------------------------------------- Old: ---- CVE-2026-63308.patch helm-4.2.4.obscpio New: ---- helm-4.3.0.obscpio ----------(Old B)---------- Old: multi-minute delays - drop CVE-2026-63308.patch: merged upstream - update vendor.tar. to fix: ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ helm.spec ++++++ --- /var/tmp/diff_new_pack.KhzO4K/_old 2026-09-19 22:20:45.308634965 +0200 +++ /var/tmp/diff_new_pack.KhzO4K/_new 2026-09-19 22:20:45.313635173 +0200 @@ -17,7 +17,7 @@ Name: helm -Version: 4.2.4 +Version: 4.3.0 Release: 0 Summary: The Kubernetes Package Manager License: Apache-2.0 @@ -25,7 +25,6 @@ URL: https://github.com/helm/helm Source0: %{name}-%{version}.tar.gz Source1: vendor.tar.zst -Patch1: CVE-2026-63308.patch BuildRequires: bash-completion BuildRequires: fish BuildRequires: zsh ++++++ _service ++++++ --- /var/tmp/diff_new_pack.KhzO4K/_old 2026-09-19 22:20:45.376637801 +0200 +++ /var/tmp/diff_new_pack.KhzO4K/_new 2026-09-19 22:20:45.383638093 +0200 @@ -5,7 +5,7 @@ <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> - <param name="revision">refs/tags/v4.2.4</param> + <param name="revision">refs/tags/v4.3.0</param> <param name="changesgenerate">disable</param> </service> <service name="set_version" mode="manual"> @@ -17,10 +17,8 @@ </service> <service name="go_modules" mode="manual"> <param name="compression">zst</param> - <param name="replace">golang.org/x/net=golang.org/x/[email protected]</param> + <param name="replace">golang.org/x/crypto=golang.org/x/[email protected]</param> <param name="replace">golang.org/x/mod=golang.org/x/[email protected]</param> - <param name="replace">oras.land/oras-go/v2=oras.land/oras-go/[email protected]</param> - <param name="replace">github.com/grpc-ecosystem/grpc-gateway/v2=github.com/grpc-ecosystem/grpc-gateway/[email protected]</param> <param name="replace">google.golang.org/grpc=google.golang.org/[email protected]</param> </service> </services> ++++++ helm-4.2.4.obscpio -> helm-4.3.0.obscpio ++++++ ++++ 41217 lines of diff (skipped) ++++++ helm.obsinfo ++++++ --- /var/tmp/diff_new_pack.KhzO4K/_old 2026-09-19 22:20:46.926702455 +0200 +++ /var/tmp/diff_new_pack.KhzO4K/_new 2026-09-19 22:20:46.935702831 +0200 @@ -1,5 +1,5 @@ name: helm -version: 4.2.4 -mtime: 1786632363 -commit: 3900f434fd3ef2b84065dc04508df48f288dba00 +version: 4.3.0 +mtime: 1788991713 +commit: bec5b06ed841fe5269972d864d5177944fd5970f ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/helm/vendor.tar.zst /work/SRC/openSUSE:Factory/.helm.new.383539/vendor.tar.zst differ: char 7, line 1
